Kubelog

Docker and Kubernetes log aggregation, inspection, export, and preview toolkit.

Kubelog is a terminal-first log aggregation tool for teams that need to inspect container logs without standing up a full observability stack. It reads Docker JSON logs, Kubernetes CRI/containerd logs, structured JSON logs, plain text logs, directories of log files, and stdin; normalizes them into one schema; then provides Rich terminal summaries, search, severity filtering, time bucketing, exports, comparisons, and a local Flask preview dashboard.

• Multi-format ingestion - Parse Docker JSON, Kubernetes CRI/containerd, JSON application logs, plain text logs, directories, and pipes.
• Log aggregation - Group by level, source, parser, namespace, pod, container, service, stream, or time bucket.
• Search and filtering - Filter by query, severity, minimum severity, namespace, pod, container, service, and time range.
• Export workflows - Write normalized logs as JSONL, CSV, or a self-contained HTML report.
• Preview server - Launch a local Flask dashboard with HTML views and JSON APIs for logs, summary, and time buckets.
• Dataset comparison - Compare two log captures by severity or Kubernetes metadata to spot regressions quickly.

Installation

pip install kubelog

Usage

Inspect a Docker JSON log:

kubelog inspect /var/lib/docker/containers/app/app-json.log

Aggregate Kubernetes pod logs by severity:

kubelog aggregate /var/log/pods --by level

Search for errors in piped logs:

kubectl logs deploy/api --all-containers | kubelog search "timeout" -

Export normalized logs:

kubelog export ./logs --format csv --out build/logs.csv --min-level WARN
kubelog export ./logs --format html --out build/report.html

Serve a local dashboard:

kubelog serve ./logs --port 8765

Compare two captures:

kubelog compare before.log after.log --by level

Commands

Configuration

Kubelog works without a config file. Use command flags to control parsing, filtering, and output:

kubelog collect ./logs \
  --source auto \
  --min-level WARN \
  --namespace production \
  --since 2h \
  --limit 200

Supported parser hints are auto, docker, kubernetes, k8s, cri, containerd, json, and plain. Relative time filters accept 15m, 2h, and 1d; ISO timestamps are also supported.

License

MIT License. See LICENSE.